Unit 42 described a campaign using malicious documents with North Korea-themed Russian-language lures to target a U.S. government agency and foreign nationals associated with North Korea. The malware set included CARROTBAT downloaders, a newer CARROTBALL FTP downloader, and SYSCON RAT payloads. CARROTBALL was embedded in a malicious Word document and used FTP to facilitate installation of SYSCON. The campaign showed evolution from the earlier Fractured Block activity while retaining similar targeting, lure themes, and document-based delivery tradecraft.